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REMARKS I 

i 
t 

The Applicant wishes to thank the Examiner for reviewing the present application. 

The Applicant notes the provisional rejection under the doctrine of obviousness-type double 
patenting in view of co-pending Application No. 09/93 1,013. However, the '013 application has; 
been abandoned, and thus this objection is moot. 

Clfiim Rgpfflippg 

The Examiner rejected claims 8 and 17 under 35 U.S.C. 1 12, second paragraph, as being 
indefinite, based on improper antecedence for the expression "grouped terms Gi", Claims 8 and I 
17 have been amended to indicate that the simultaneous multiple addition involves precomputing; 
a value Gi representing a grouping of like elements as described on page 6, line 25 to page 7, 
linelO. Accordingly, claims 8 and 17 are submitted to comply with 35 U.S.C. 112, second 
paragraph. 

The Examiner rejected claims 1-8, and 10-17 under 35 U.S.C. 102(e) as being anticipated by 
US. Patent No. 5,999,626 to Mullin. The Applicant respectfully disagrees. 

The present invention is directed towards a method for improving the efficiency of 

multiplying an elliptic curve point Q with an integer k. In claim 1, the integer k is represented as ; 

I 

a set of components ki, such that ki = Zi k&, and this representation is used to obtain a value of ; 
kQ from k 0 Q + k A \j/(Q)+ ... 

Mullin teaches the application of the Frobenius operator to sets of precomputed points (ki, 
kjP) to compute a pair (k, kP). Mullin starts with the sets (k„ kiP) a priori and ends with the 
computed point (k, kP) a posteriori. Mullin does not teach how to compute a scalar multiple of a ; 
point, but rather teaches how to derive a new point from an existing point, and how to derive the 
corresponding scalar multiple for the new point. 

In the general embodiment of Mullin shown in Figure 3, the starting point is a key pair k 2) 
k 2 P used to derive new values k„, kJP, k^P is obtained by the application of the Frobenius 
operator to the gsM kaP, and there is no contemplation of multiplying k*P by another scalar k to 
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obtain kJP. In other words, figure 3 of Mull in does not suggest generating a new k and 
performing a scalar multiplication on a point, In fact, Mullin teaches independently deriving the 
new value of k through the use of Xj, which in turn depends on the number of Frobenius 
operations performed on the point However, the value of k computed is the scalar multiple of 
the seed point P, not the scalar multiple to get from k 3 P to kJP. 

The Examiner has referred to various passages in Mullin to support the above rejection. 
However, none of the passages cited suggest representing a scalar in the way recited in claim 1, 
and combining it with a point to generate a new point. 

Moreover, the embodiment of Figure 4 of Mullin shows the combination of two points, 
namely kiP and kz? 9 to obtain a third point k3?. Again, however, there is no scalar multiplication 
of a point, simply a Frobenius operation and a point addition. 

Accordingly, Mullin fails to teach a method of multiplying a point Q by a scalar k, or 
representing the scalar k in the form required in claim 1. Therefore, claim 1 is believed to clearly 
and patentably distinguish over Mullin. Claims 2-9 are either directly or indirectly dependent on 
claim 1, and as such are also believed to distinguish over Mullin. 

Claim 10 is directed to a method which also involves generating a new k and performing a 
scalar multiplication on a point Q, and therefore, the arguments made in respect of claim 1 apply < 
equally to claim 10. Claims 1 1-18 are directly or indirectly dependent on claim 10, and as such, 
are also believed to distinguish over Mullin. 

The Examiner rejected claims 9 and 18 under 35 U.S.C. 103(a) as being unpatentable over 
Mullin in view of U.S. Patent No. 6,243,467 to Reiter. The Applicant respectfully disagrees. 

In order for there a prima facie case of obviousness to be established, Reiter must at least 
teach, inter alia, the elements of the claims not taught by Mullin. The Applicants will show that i 
Reiter does not teach generating a new k and performing a scalar multiplication on a point Q. 

Reiter teaches computing kP for a given input integer k by using the Frobenius 
endomorphism ^ to write k = ^ . However, Reiter teaches the use of a decomposition 

algorithm that uses very specific properties of the Frobenius endomorphism. These properties do! 
not hold for an arbitrary endomorphism. 
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In particular, Reiter teaches decomposing a given integer k as k = ^krf* by repeated 

division by x in the ring Z[t]. The fundamental property is that an arbitrary element 7 in Z[t] 
may be written as 7 = q t + k in the ring, where the quotient q and the remainder k are in the ring; 



and N(k) < N(t), where N is a Norm function in the ring. Continuing in this manner by dividing ' 



Reiter, however, does not teach a method of multiplying a point Q by a scalar k, or 
representing the scalar k in the form required in claim 1 . Therefore, Reiter does not teach the i 
missing elements from Mullin, and as such, claims 1-18 are believed to be patentable over the 
combination of Mullin and Reiter. 

Accordingly, the Applicants believe that claims 1-18 clearly and patentably distinguish over i 
Mullin, and the combination of Mullin and Reiter, and as such, are in condition for allowance. 

Applicant requests early reconsideration and allowance of the present application. j 
Respectfully submitted, 



the quotient q by t often produces a representation of 7 as J]. £,t' in the ring as desired. 
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